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REQUEST FOR CERTIFICATE OF CORRECTION OF PATENT 

Dear Sir: 

Please find attached a Certificate of Correction (Form PTO/SB/044). The error was in 
part the fault of the Patent and Trademark Office. The facts are as follows: On April 13, 2006, 
Applicant filed a Request for Prc-Appeal, and a Pre- Appeal Brief Sometime between April 13, 
2006 and May 23, 2006, the Examiner called Applicants' undersigned attorney and requested to 
amend claim 31 by Examiner's Amendment to put claim 31 into condition for allowance. During 
that telephone call, the Examiner and Applicants' undersigned attomey agreed to the following 
amendment to claim 31 : 
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31. A method of detecting intrusions, said method comprising the steps of: 
storing a pluraUty of intrusion signatures; 

automatically detecting a multiplicity of system events having respective signatures; 

comparing each of the multipHcity of system event signatures to said plurality of intrusion 
signatures, one of said system event signatures not matching any of said intrusion signatures and 
not corresponding to an intrusion, and other of said system event signatures matching respective 
ones of said intrusion signatures; and 

storing said one system event signature not corresponding to an intrusion in association 
with said plurality of intrusion signatures; 

recording a number of times that said each of said intrusion signatures matches a 
respective one of said system event signatures; 

recording a number of times that said one system event has occurred; 

subsequently ordering the stored plurality of intrusion signatures and said one system 
event signature based on the respective number of times that have been recorded for said 
plurality of intrusion signatures and said one system event signature, such that the signature for 
which the most number of times has been recorded is first in the order; and 

subsequently comparing a signature of a subsequent system event with said signatures in 
said order until finding a match between said subsequent system event signature and one of said 
signatures in said order. 
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On May 23, 2006, the Examiner sent to Applicants a Notice of Allowability with an 
incorrect version of amended claim 3 1 . in this incorrect version of amended claim 3 1 , the 
Examiner improperly situated the phrase "not corresponding to an intrusion" at the very end of 
the storing step instead of after the term "event signature" in the middle of the storing step. 
Applicants did not notice this error, and the patent application issued with this phrase "not 
corresponding to an intrusion" at the very end of the storing step instead of after the term "event 
signature" as previously agreed by Applicants' undersigned attorney and the Examiner. This 
significantly changes the scope of the claim. Therefore, Applicants request a Certificate of 
Correction. 

Please charge Deposit Account No. 09-0457 for the Certificate of Correction and for any 
other fees which may be required. 



Respectfiilly submitted. 
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